Apparatus and method for linguistic scoring

ABSTRACT

In embodiments of the invention, a system receives selections from a user based on a list of pre-defined monitoring categories and/or optionally receives custom category definitions from the user. The option for custom category definitions may be advantageous due to the flexibility provided to a system administrator or other user. In embodiments of the invention, the pre-defined and/or custom monitoring categories may be or include complex hierarchical behavior. Such an approach provides monitoring algorithms that can achieve improved accuracy compared to known methods. In embodiments of the invention, the order of computations used in resolving a monitoring category may be re-ordered, statically and/or dynamically, to improve the efficiency of monitoring operations.

RELATED APPLICATION AND COPYRIGHT

The present application claims priority of co-pending U.S. Ser. No.10/748,677 filed Dec. 31, 2003, which is incorporated herein in itsentirety by this reference. With regard to copyrights, a portion of thedisclosure of this patent document contains material that is subject tocopyright protection. The copyright owner has no objection to thefacsimile reproduction by anyone of the patent disclosure, as it appearsin the U.S. Patent & Trademark Office patent files or records, butotherwise reserves all copyright rights whatsoever.

FIELD OF THE INVENTION

The invention relates to linguistic analysis. In particular, but not byway of limitation, the invention relates to systems and methods forscoring textual data based on relevance of the textual data to one ormore pre-defined and/or custom categories.

BACKGROUND OF THE INVENTION

Network-based communications, for example those enabled by the Internet,have made available a wide variety of data to network users. But alldata types may not be appropriate for all user types. For example, aparent may seek to protect their children from pornographic Web sites,and an employer may seek to prevent hate speech or other categories ofcommunications within their private enterprise. Accordingly, systems andmethods have been developed to monitor network-based communications sothat access to such data can then be blocked or reported, for example.

Known systems and methods for monitoring data communications have manydisadvantages, however. For instance, methods that function based onsimple keyword searches typically produce false positives and/or otherinaccurate results. Moreover, methods that employ more complex searchingalgorithms may require large overhead in terms of resources andprocessing time, resulting in delayed or otherwise ineffectiveoperation.

Better techniques are needed for data monitoring that allow for theapplication of more accurate monitoring algorithms in a morecomputationally-efficient manner.

SUMMARY OF THE INVENTION

In embodiments of the invention, a system receives selections from auser based on a list of pre-defined monitoring categories and/oroptionally receives custom category definitions from the user. Theoption for custom category definitions may be advantageous due to theflexibility provided to a system administrator or other user. Inembodiments of the invention, the pre-defined and/or custom monitoringcategories may be or include complex hierarchical behavior. Such anapproach provides monitoring algorithms that can achieve improvedaccuracy compared to known methods. In embodiments of the invention, thecomputations used in resolving a monitoring category may be re-ordered,statically and/or dynamically, to improve the efficiency of monitoringoperations.

Exemplary embodiments of the invention shown in the drawings aresummarized below. These and other embodiments are more fully describedin the Detailed Description section. It is to be understood, however,that there is no intention to limit the invention to the forms describedin this Summary of the Invention or in the Detailed Description. Oneskilled in the art can recognize that there are numerous modifications,equivalents and alternative constructions that fall within the spiritand scope of the invention as expressed in the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Various objects, advantages, and a more complete understanding of theinvention are apparent and more readily appreciated by reference to thefollowing Detailed Description and to the appended claims when taken inconjunction with the accompanying Drawings wherein:

FIG. 1 is a functional architecture for a linguistic analysis system,according to an embodiment of the invention;

FIG. 2 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention;

FIG. 3 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention;

FIG. 4 is a schematic diagram of a trigger, according to an embodimentof the invention;

FIG. 5 is a schematic diagram of an ordered list of pre-requisitetriggers, according to an embodiment of the invention;

FIG. 6 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention;

FIG. 7 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention;

FIG. 8A is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention;

FIG. 8B is an illustration of a truth table for performing linguisticanalysis, according to an embodiment of the invention; and

FIG. 9 is a process flow diagram for a dynamic reordering method,according to an embodiment of the invention.

DETAILED DESCRIPTION

This section begins with a description of a functional architecture formonitoring a data source, then provides a top-level process flow forperforming linguistic scoring on the monitored data source. Scoring, asused herein, refers to the underlying computations required indetermining whether a category is a hit (e.g., whether or not the datasource has been resolved to be within a particular category). Scoring isthen described as a complex aggregate behavior, where, for example, acategory definition may include multiple pre-requisite triggers. As usedherein, a trigger is a regular expression (regex) or other code thatperforms a textual search function. Accordingly, a discussion isprovided on how such linguistic triggers may be aggregated, how suchtriggers may be constructed, and how complex aggregated behavior may besimplified. The discussion of threshold scoring includes a descriptionof static re-ordering of pre-requisite triggers to improve scoringefficiency. Exemplary embodiments are also provided for Boolean logicscoring behavior using two or more pre-requisite triggers. The detaileddescription concludes with a discussion of dynamic re-ordering ofpre-requisite triggers, which may be applied to Boolean scoring behaviorand/or threshold scoring behavior as another way to improve theefficiency of linguistic scoring.

While sub-headings are used in this section for organizationalconvenience, the disclosure of any particular feature(s) is/are notnecessarily limited to any particular section or sub-section of thisspecification. The detailed description begins with the functionalarchitecture.

Functional Architecture

FIG. 1 is a functional architecture for a linguistic analysis system,according to an embodiment of the invention. As shown therein, alinguistic analysis system includes an Internet 102, a Web page host104, an email server 106, a router/firewall 108, a Linguistic AnalysisServer (LAS) 110, an intranet 112, and network clients 114, 116 and 118.

The email server 106, router/firewall 108, LAS 110, and clients 114, 116and 118 are coupled to the intranet 112, and the Internet 102 is coupledto the router/firewall 108 and the Web page host 104.

In operation, the LAS 110 monitors data communications on intranet 112associated with one or more clients 114, 116 and/or 118. For example,the LAS 110 may be configured to monitor email communications, chat,instant messaging (IM), point-to-point (P2P) communications, FileTransfer Protocol (FTP) communications, and/or URL-based Web browsercommunications. In addition, communications monitored by the LAS 110 maybe communications local to the intranet 112 and/or between any one ofclients 114, 116, and 118 and the Internet 102, for example.

The LAS 110 may be or include, for example, a computer having an Intel 3GHz processor, 2 GB of Random Access Memory (RAM), a 120 GB hard drive,a Compact Disc Read-Only Memory (CD ROM), and a Red Hat Linux OperatingSystem (OS). The clients 114, 116, and/or 118 may be or include, forexample, a personal computer, a Personal Data Assistant (PDA), aWeb-enabled telephone, or other networkable user interface device.

Various architecture alternatives are possible in addition to the onedepicted in FIG. 1. For example, Internet 102, Webpage Host 104, emailserver 106 and router/firewall 108 are optional system components.Further, intranet 112 and/or Internet 102 may be replaced, for example,by a Local Area Network (LAN), Wide Area Network (WAN), or other wiredor wireless network configuration. In addition, the LAS 110 may onlymonitor traffic local to the intranet 112, or only between, for example,clients 114,116, and 118 and the Internet 102. Moreover, in alternativeembodiments, the functionality of LAS 110 may reside in, for example,email server 106, router/firewall 108, and/or in each of the clients114, 116, and 118.

The linguistic analysis processes described below with reference toFIGS. 2, 3, and 6-9 may be implemented with computer-executable code.Moreover, such code may be stored on a CD ROM, hard drive, or other datastorage medium and/or loaded into RAM for execution by a processor. Forexample, code for performing the processes described herein may bestored in the 120 GB hard drive of the LAS 100, loaded into the RAM ofthe LAS 110, and executed by the 3 GHz processor of the LAS 110.

Top-Level Process Flow

FIG. 2 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention. FIG. 2 isdepicted from the perspective of LAS 110. As shown therein, the processbegins by receiving a selection from a list of pre-defined categories instep 202. The predefined categories may be, for instance, categoriessuch as: adult, confidential, conflict, gambling, games, merger andacquisition, racism, resignation, shopping, sports, substance abuse,stock trading, and/or other predefined data category. A systemadministrator or other user of LAS 110 may select the predefinedcategories based on an Approved Usage Policy (AUP) for a corporation, orbased other criterion.

Next, in step 204, the LAS 110 optionally receives a custom categorydefinition. A custom category definition may be based on one or more ofthe predefined categories. For example, in the case where a user hasselected the predefined category of mergers and acquisitions, a user mayfurther specify that when a hit is resolved for the predefined categoryof mergers and acquisitions, a custom category is resolved based on aparticular company name. Accordingly, the form of a custom categorydefinition may include both search criteria (e.g., a particular companyname) and a link to a selected category (e.g., mergers andacquisitions).

Then, in step 206, the LAS 110 prepares the data source for analysis.

Step 206 may include collecting data from a data stream, a file system,database, or other data source. Step 206 may further include, incombination with, or in the alternative to collecting data, partitioningthe data into sessions, groups of sessions, or other logical group(s)for analysis. For example, in step 206, LAS 110 may collect an emailcorrespondence and its reply from email server 102 for linguisticscoring.

Next, in step 208 the LAS 110 performs scoring of input data sourcesresulting from step 206 against the selected predefined categoriesand/or custom categories received in steps 202 and 204, respectively.

Finally, in step 210, the system performs predetermined action(s) foreach of the selected and/or custom categories that is resolved as a hit(also referred to herein as resolved-positive). Such action may include,for instance, blocking a URL, alerting an administrator via email,pager, or Simple Network Management Protocol (SNMP) trap, or loggingdata for later review by a system administrator, manager, or other user.

Linguistic Triggers

As mentioned above, a trigger is a regular expression (regex) or othercode that performs a textual search function. A category is a namedtrigger. Triggers and/or categories can be arranged into a hierarchy ofcomplex aggregate behavior, as illustrated in FIG. 3 and describedbelow.

FIG. 3 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention. As shown therein,data source 302 is a pre-requisite for resolution of triggers 304, 306,312, 314, and 316. Moreover, Triggers 304 and 306 are pre-requisitetriggers (or contained triggers) for containing trigger 310. Likewise,triggers 310 and 312 are pre-requisite triggers for category 318,triggers 312 and 314 are pre-requisite triggers for category 320, andcategory 320 and trigger 316 are pre-requisite triggers for category324.

A predefined score is associated with each trigger. When a containedtrigger is resolved as a hit, the scores of all contained triggers areused in resolving the containing trigger. For example, if both triggers310 and 312 are resolved positive (determined to be as a hit), thencategory 318 would be resolved using the predefined scores from triggers310 and 312.

FIG. 3 illustrates that a score may be modified in resolving acontaining trigger. For example, if trigger 304 is resolved as a hit,then the score associated with trigger 304 is increased by 5, asillustrated by addition operator 308, in resolving trigger 310. Theeffect of addition operator 308 is to add increased importance totrigger 304 in resolving trigger 310. In the alternative, or incombination with addition operators, subtraction, multiplication, and/ordivision operators could be used to similar effect.

The addition operator 308 is a property of the containing trigger 310.The reason for this is more apparent when considering the relativeimportance of trigger 312 in FIG. 3: if trigger 312 is a hit, its scoreis not modified in resolving category 318, but is increased by 10 inresolving category 320.

Another way that a score can be modified is with a negation operator. Inthe illustrated example, where trigger 316 is resolved as a hit, thescore associated with trigger 316 is negated by negation operator 322 inresolving category 324. Like the addition operator, the negationoperator is a property of the containing trigger.

Trigger 316, category 324, and associated links are illustrated indashed lines to indicate that category 324 may be a custom categoryrather than a predefined category.

FIG. 4 is a schematic diagram of a trigger, according to an embodimentof the invention. As shown therein, a trigger may include status data404, invert data 406, threshold data 408, tally data 410, an orderedlist of pre-requisite triggers 412, a pattern tuple 414, a list oftriggers that are potentially updated if the status of the currenttrigger becomes resolved-positive 416, a list of triggers that arepotentially updated if the status of the current trigger becomesresolved-negative 418, a user-specified name (e.g., a category name) 420and a list of actions 422 if the category is resolved positive.

Status data 404 may be unresolved, resolved-positive, orresolved-negative. The effect of the resolved status may be invertedaccording to invert data 406.

Threshold data 408 is a predetermined number that may be used to resolvea trigger. For example, if a containing trigger has a threshold of 5,and the only pre-requisite trigger has been resolved positive and has ascore of 6, then the threshold of the containing trigger has beenexceeded, and the containing trigger is resolved-positive.

The tally 410 is a parameter (e.g., a running total) that reflects theeffect of all pre-requisite triggers that have been considered inresolving the containing trigger. The ordered list of pre-requisitetriggers 412 provides information about the contained triggers (used ifthe status of the containing trigger is unresolved), and will bedescribed in more detail with reference to FIG. 5 below. Pattern Tuple414 includes a reference to a particular pattern-evaluation engine.Potential pattern-evaluation engines include regular expression engines,string matchers, numeric and character comparisons,IP-in-network/netmask-range, “always true” and “always false”. PatternTuple 414 may further include a reference to some data. This may be“raw” data, the result of applying transformations to the raw data, ordata related to the raw data. One example transformation is convertingall uppercase letters to lowercase. Related data includes the length ofthe data. If the data is extracted from network traffic, related datamay also include the IPs of the involved hosts or information associatedwith the IPs of the involved hosts. If the data is extracted from a filesystem, related data may also include the name of the file, permissionsof the file, and owner(s) of the file. In addition, evaluation of apattern tuple may generate more data that subsequently may be used inother pattern tuples. This additional data, which may also be includedin pattern tuple 414, may include a number of times the pattern matched,offsets from the beginning of the data to the beginning or end ofmatched data, etc.

The list of triggers that are potentially updated if the status of thecurrent trigger becomes resolved-positive 416 is self-descriptive. As anillustration with reference to FIG. 3, trigger 312 would includecategory 318 and category 320 in list 416.

The list of triggers that are potentially updated if the status of thecurrent trigger becomes resolved-negative 418 is also self-descriptive.Such cases may arise, for instance, where the data is inverted. Forexample, consider a gambling trigger containing a news storypre-requisite trigger, where the new story pre-requisite trigger hasinvert data 406. In this case, the gambling trigger is only evaluated ifthe news trigger is not a hit. The effect is that gambling is not scoredfor news stories related to gambling.

It should be noted that all of the data illustrated as part oftrigger/category 402 in FIG. 4 and described above are optional.

Complex aggregate behavior models may be simplified with reference todata included in trigger/category 402. For example, two or more triggerscontaining the same pattern tuple may be collapsed into exactly onetrigger so a pattern tuple is never evaluated more than once. In thisinstance, resolved-positive output lists 416 and resolved-negativeoutput lists 418 are appended. Further, one or more triggers containingan identical list of prerequisite triggers 504, respective scores 506,and respective negate statuses 406 may be collapsed into exactly onetrigger so the list is never evaluated more than once.

As another example of computational simplification, the system may beconfigured so that only categories having at least one action 422 (andall prerequisite triggers of such categories) are loaded into RAM and/orresolved. Thus, with reference to FIG. 3, if categories 320 and 324 eachincluded actions 422, but category 318 did not include any actions 422,then trigger 304, trigger 306, trigger 310, and category 318 would notbe loaded into RAM and/or would not be resolved.

FIG. 5 is a schematic diagram of an ordered list of pre-requisitetriggers, according to an embodiment of the invention. As shown therein,an ordered list 502 includes a list of prerequisite triggers 504, a listof scores for each of the prerequisite triggers 506, a total for allsubsequent positive scores 508, and a total for all subsequent negativescores 510.

Threshold Scoring

FIG. 6 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention. To illustrate theoperation of the process in FIG. 6, consider a containing trigger havingthree pre-requisite triggers: trigger A is associated with a score of−2, trigger B is associated with a score of +1, and trigger C isassociated with a score of +13.

The process begins in step 602 with receiving a data source. Next, instep 604, the tally for a containing trigger is set equal to zero. Then,in step 606, the system orders contained triggers based on decreasingabsolute value of scores. In the example presented, the containedtriggers would be ordered: C, A, and B in step 606. The system mayexecute step 606 using the list of prerequisite triggers 504 and thelist of scores for each of the prerequisite triggers 506. Step 606 is anexample of static re-ordering of triggers within a complex aggregatebehavior.

In step 608, the process selects the first or next trigger (in thepreceding example, trigger C would be selected first).

In conditional step 610, it is determined whether the first or nextcontained trigger is a hit. If conditional step 610 is affirmative, theprocess advances to step 612 to update the tally for the containingtrigger. Thus, if trigger C were to be resolved positive, then the tallyfor the containing trigger would be 13 (since 0+13=13).

Then, in conditional step 614, it is determined whether the tally forthe containing trigger—(the sum of absolute values of subsequentcontained triggers) is >a predetermined threshold. Thus, if thepredetermined threshold were 5, then the result of conditional step 614would be positive (since the sum of the absolute value of subsequentcontained triggers would be 3, and since 13−3=10, and since 10 is >5).In this instance, the containing trigger is a hit (resolved positive) instep 616. Note that conditional step 614 may be calculated using thetotal for all subsequent positive scores 508, and the total for allsubsequent negative scores 510.

Where the result of conditional steps 610 or 614 are in the negative,however, the process advances to conditional step 618 where it isdetermined whether the process is done. In other words, in step 618, itis determined whether all contained triggers have been evaluated. Wherethe result of conditional step 618 is in the affirmative, the processadvances to step 620 where the containing trigger is identified as anon-hit (resolved negative). On the other hand, where the result ofconditional step 618 is in the negative, the process advances to step608 to select the next contained trigger (as ordered in step 606) beforereturning to conditional step 610.

Advantageously, step 614 operates to provide an early exit where acontaining trigger can be resolved by evaluating less than allpre-requisite triggers. In addition, the effect of ordering step 606 andselection step 608 is to further improve the efficiency of a triggerhaving an early exit feature.

There are two special-case scores that may be added to a tally (notillustrated in FIG. 6). First, if +MAX is applied to a tally, thethreshold is immediately considered to be exceeded (and the trigger isresolved positive) regardless of the total of all remaining negativescores. Second, if −MAX is applied to a tally, the threshold isimmediately considered to be not-exceeded (and the trigger is resolvednegative) regardless of the total of all remaining positive scores.

Boolean Logic

As an alternative to a trigger that is configured to perform a thresholdcomparison, a trigger may be configured to perform a Boolean logicfunction. In such cases, the predetermined threshold is zero.

FIG. 7 is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention. In particular,FIG. 7 illustrates a logical AND function for a category havingprerequisite triggers identified as a first trigger and a secondtrigger. FIG. 7 further illustrates the application of a pattern tuple.

The process begins in step 702 by receiving a data source. Next, theprocess advances to conditional step 704 where it is determined whetherthe input data source is from a particular source account X. As usedherein, a source account may be an alias associated with any descriptionof source. For example, with reference to email correspondence, a sourceaccount may be an alias associated with From, MAIL FROM, and Reply Tofields. Where the result of conditional step 704 is in the negative, theprocess advances to step 718 where the category tally is set to −MAX,and the category is a non-hit (resolved negative) in step 720. Steps 704and 718 may be based on a pattern tuple 414.

Where the result of conditional step 704 is in the affirmative, theprocess advances to step 706 where it is determined whether the firsttrigger is a hit. Where the result of conditional step 706 is in theaffirmative, the process advances to step 708 where it is determinedwhether the score for the first trigger is >0. Where the result ofconditional step 708 is in the affirmative, the process advances to step710 where it is determined whether the second trigger is a hit. Wherethe result of conditional step 710 is in the affirmative, the processadvances to step 712 where it is determined whether the score for thesecond trigger is >0. Where the result of conditional step 712 is in theaffirmative, the category is a hit (resolved positive) in step 614 andthe process will terminate with actions in step 716.

Where the result of conditional steps 706, 708, 710, or 712 are in thenegative, the process also advances to step 720 indicating a non-hit ofthe category.

Accordingly, for the process illustrated in FIG. 7, the category is ahit only when both the first trigger and the second trigger are hits,and where their associated scores are greater than zero. FIG. 7 alsoillustrates that where −MAX is applied to a trigger tally, the triggeris immediately considered to be a non-hit. FIG. 7 also illustrates anearly exit for the case where the first trigger is not a hit (since inthis instance, the second trigger is not evaluated).

FIG. 8A is a process flow diagram of a method for performing linguisticanalysis, according to an embodiment of the invention. In particular,FIG. 8A illustrates a logical OR function for a category havingprerequisite triggers identified as a first trigger and a secondtrigger. FIG. 8A further illustrates the application of a pattern tuple.

The process begins in step 802 with receiving a data source. Next, theprocess advances to conditional step 804 where it is determined whethera source IP address is =123.45.678.910 in step 804. Where the result ofconditional step 804 is in the negative, the process advances to step814 where the category tally is set to −MAX, and the category is anon-hit (resolved negative) in step 820. Steps 804 and 814 may be basedon a pattern tuple 414.

Where the result of conditional step 804 is in the affirmative, theprocess advances to conditional step 806 to determine whether the firsttrigger is a hit. Where the result of conditional step 806 is in theaffirmative, the process advances to step 808 where it is determinedwhether the score for the first trigger is >0. Where the result ofconditional step 806 is in the affirmative, then the process advances tostep 810, indicating that the category is a hit (resolved positive).Then, in step 812, appropriate action for the category is performed.

Where the result of conditional step 806 or 808 are in the negative, theprocess advances to conditional step 816 to determine whether the secondtrigger is a hit. Where the result of conditional step 816 is in theaffirmative, the process advances to step 818 to determine whether thescore for the second trigger is >0. Where the result of conditional step818 is in the affirmative, the process advances to step 810, indicatingthat the category is a hit. Where the result of conditional steps 816 or818 are in the negative, the process advances to step 820, indicatingthat the category is a non-hit.

Thus, FIG. 8A illustrates that the category will be a hit where eitherthe first trigger is a hit and has a score greater than zero, or wherethe second trigger is a hit and has a score greater than zero. FIG. 8Aalso illustrates that where—MAX is applied to a trigger tally, thetrigger is immediately considered to be a non-hit. FIG. 8A furtherillustrates an early exit function, since the category is resolvedpositive if it is determined that the first category is a hit and has ascore >0.

FIG. 8B is an illustration of a truth table for performing linguisticanalysis, according to an embodiment of the invention. In particular,FIG. 8B is a truth table for a category having a logical OR functionbased on 1.sup.st and 2.sup.nd pre-requisite triggers. The category alsoincludes a pattern tuple that is seeking to match a particular IPaddress.

As Shown in FIG. 8B, column 822 indicates whether the IP address of theinput data is 123.45.678.910; column 824 indicates whether the 1.sup.sttrigger score is >0; column 826 indicates whether the 2.sup.nd triggerscore is >0; and column 828 indicates whether the category result willbe a hit (resolved positive) or a non-hit (resolved negative).

Triggers may include other Boolean logic operations. For example, sincea result may be inverted (a logical NOT), the AND and OR functionsdescribed above may be combined to produce an Exclusive OR (XOR)function. Thus, where p and q are pre-requisite triggers, p XOR q couldbe implemented via the following expression: (p AND (NOT q)) OR ((NOT p)AND q).

Dynamic Re-Ordering

FIG. 9 is a process flow diagram for a dynamic reordering method,according to an embodiment of the invention. As shown therein, theprocess begins in step 902 by initializing an Avoid Evaluation of ThisTrigger (AEOTT) rating. Next, in step 904, the process evaluates a firstor next data source (e.g., resolves a pre-requisite trigger for thefirst or next data source). Then, in step 906, it is determined whetherthe contained trigger caused an early exit. Where the result ofconditional step 906 is in the affirmative, the process advances to step908 where the AEOTT is decreased for the contained trigger. On the otherhand, where the result of conditional step 906 is in the negative, theprocess advances to step 910 where the AEOTT is increased for thecontained trigger. After either step 908 or step 910, the processreturns to step 904 to evaluate a next data source.

Accordingly, the process in FIG. 9 illustrates that an AEOTT rating canbe either incremented or decremented based on whether it is determinedin step 906 that the contained trigger caused an early exit. Forexample, with reference to FIG. 7, where a higher AEOTT causes apre-requisite trigger to be evaluated later, and where it is determinedthat the first trigger did not cause an early exit, the AEOTT rating forthe first trigger would be increased. Over time, the result is that thetrigger most likely to cause an early exit (a non-hit in the case of anAND function) will be evaluated prior to other pre-requisite triggers.

Although described above with reference to triggers having logicalfunctions, adaptive reordering could be applied to pattern tuples.Moreover, adaptive or dynamic reordering could be applied to thresholdscoring in combination with, or in the alternative to, static triggerordering described with reference to FIG. 6.

In conclusion, embodiments of the invention provide, among other things,a robust and efficient system and method for linguistic scoring. Thoseskilled in the art can readily recognize that numerous variations andsubstitutions may be made in the invention, its use and itsconfiguration to achieve substantially the same results as achieved bythe embodiments described herein. Accordingly, there is no intention tolimit the invention to the disclosed exemplary forms. Many variations,modifications and alternative constructions fall within the scope andspirit of the disclosed invention as expressed in the claims. Forexample, although thresholds are expressed in terms of whether a tallyis greater than a predetermined threshold, the processes could bealtered so that the test is whether the tally is greater than or equalto the predetermined threshold. In addition, although references aremade to embodiments of the invention, all embodiments disclosed hereinneed not be separate embodiments. In other words, many of the featuresdisclosed herein can be utilized in combinations not expresslyillustrated.

1. A method for linguistic analysis comprising: receiving a userselection of at least one category from a list of pre-definedcategories, wherein the categories include complex aggregate behaviorwith a plurality of triggers in a hierarchical relationship; preparingdata by collecting the data from at least one of a data stream, a filesystem, and a database; evaluating and scoring the data for the selectedat least one category based on the complex aggregate behaviour; andwherein responsive to at least one of the plurality of triggers causingan early exit, modifying the hierarchical relationship of triggers. 2.The method of claim 1, further comprising receiving a custom categorydefinition from the user, scoring the data further based on the customcategory definition.
 3. The method of claim 2, wherein the customcategory is dependent upon the user-selected category.
 4. The method ofclaim 1, further comprising: determining whether the user-selectedcategory is a hit based on the tally; and performing at least onepredetermined action where it is determined that the user-selectedcategory is a hit.
 5. The method of claim 4, wherein determining isbased on at least one of threshold scoring and Boolean logic scoring. 6.The method of claim 4, wherein the predetermined action is at least oneof blocking access, alerting an administrator, and logging data.
 7. Themethod of linguistic analysis of claim 1, wherein the step of evaluatingand scoring the data comprises a plurality of computations and themethod further comprises dynamically re-ordering the computations. 8.The method of claim 7, wherein defining complex aggregate behaviorincludes associating a score with each of the plurality of triggers. 9.The method of claim 8, wherein defining complex aggregate behaviorfurther includes applying at least one of an addition operator, asubtraction operator, a multiplication operator and a division operatorto the score associated with at least one of the plurality of triggers.10. The method of claim 8, wherein defining complex aggregate behaviorfurther includes applying a negation operator to the score of at leastone of the plurality of triggers.
 11. The method of claim 7, whereindefining complex aggregate behavior includes associating a pattern tuplewith at least one of the plurality of triggers.
 12. The method of claim11, further comprising simplifying the complex aggregate behavior bycombining two or more triggers having the same associated pattern tuple.13. The method of claim 7, wherein defining complex aggregate behaviorincludes associating a list of pre-requisite triggers, scores for eachof the pre-requisite triggers, and negation status with at least one ofthe plurality of triggers.
 14. The method of claim 13, furthercomprising simplifying the complex aggregate behavior by combining twoor more triggers having the same associated list of pre-requisitetriggers, scores for each of the pre-requisite triggers, and negationstatus.
 15. The method of claim 7, wherein defining complex aggregatebehavior includes associating at least one of a plurality of actionswith at least one of the plurality of triggers.
 16. The method of claim15, further comprising simplifying the complex aggregate behavior by notresolving any of the plurality of triggers that are not associated withat least one of the plurality of actions.
 17. A method for linguisticanalysis comprising: receiving data; setting a tally for a containingtrigger equal to zero; ordering a plurality of pre-requisite triggersbased on decreasing absolute value of a score associated with each ofthe plurality of pre-requisite triggers; selecting one of the pluralityof pre-requisite triggers based on the order; and determining whetherthe selected on of the plurality of pre-requisite triggers is a hit andresponsive to the selected one of the plurality of pre-requisitetriggers being a hit and causing an early exit modifying the order ofthe plurality of pre-requisite triggers.
 18. The method of claim 17,further comprising: when the selected one of the plurality of triggersis a hit, updating the tally by adding to the tally the score associatedwith the selected one of the plurality of triggers; determining whetherthe updated tally less the sum of absolute values of scores associatedwith each unresolved trigger within the plurality of pre-requisitetriggers is greater than a predetermined threshold; and when the updatedtally less the sum of absolute values of scores associated with eachunresolved trigger within the plurality of pre-requisite triggers isgreater than the predetermined threshold, resolving the containingtrigger as a hit.
 19. The method of claim 18, further comprising: if theupdated tally less the sum of absolute values of scores associated witheach unresolved trigger within the plurality of pre-requisite triggersis not greater than the predetermined threshold, determining whethereach of the pre-requisite triggers have been selected; and if each ofthe pre-requisite triggers have been selected, resolving the containingtrigger as a non-hit. 20-22. (canceled)
 23. A method for linguisticanalysis comprising: defining a category having a first pre-requisitetrigger and a second pre-requisite trigger in a hierarchal order;receiving a first data set; determining whether the first pre-requisitetrigger is a hit based on the first data set; if the first pre-requisitetrigger is a hit, determining whether a score of the first pre-requisitetrigger is greater than zero; if the score of the first pre-requisitetrigger is greater than zero, resolving the category as a hit withrespect to the first data set; if the first pre-requisite trigger is nota hit, determining whether the second pre-requisite trigger is a hitbased on the first data set; if the second pre-requisite trigger is ahit, determining whether a score of the second pre-requisite trigger isgreater than zero; and if the score of the second pre-requisite triggeris greater than zero, resolving the category as a hit with respect tothe first data set and when the score of the second pre-requisitetrigger causes an early exit, modify the hierarchal order such that thesecond pre-requisite trigger is scored before the first pre-requisitetrigger in subsequent analysed. 24-25. (canceled)